social engineering news
11 stories
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google's Threat Intelligence Group (GTIG) has identified three distinct Russia-linked cyber espionage clusters, designated UNC6293, UNC7005, and UNC5976, which are targeting researchers, academics, government officials, think-tank analysts, and defense sector personnel in Europe and the United States. These groups employ persistent and adaptive phishing campaigns, leveraging sophisticated…
No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns
A new AI platform, dubbed "Kriminal," has reportedly emerged, offering unrestricted tools that raise significant concerns about their potential misuse in cybercrime. While the platform officially states a prohibition against illicit activities, its functionalities are openly available to users who pay with cryptocurrency, effectively bypassing any meaningful restrictions.
Phishing 3.0: The Fight Moves to Agent Versus Agent
The cybersecurity community is reportedly facing a new phase of attack, dubbed "Phishing 3.0," characterized by the increasing deployment of AI-powered agents by malicious actors. This development signifies a shift in the nature of phishing campaigns, moving towards more automated and sophisticated multi-channel assaults. The core concern is that these AI agents are enhancing attackers'…
Inside the Modern SOC: The Identity Front Door
Attackers are increasingly leveraging compromised identities to gain initial access to enterprise environments, with identity weaknesses playing a role in nearly 90% of incidents investigated by Unit 42, a cybersecurity research and incident response team. This trend is highlighted in the 2026 Unit 42 Global Incident Response Report, which also indicates that 65% of initial access activities…
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
A cybercrime group, identified as UNC6671, has reportedly launched a series of vishing attacks aimed at employees' personal phones to compromise Software-as-a-Service (SaaS) data. The attacks involve the impersonation of IT support personnel, with the ultimate goal of tricking individuals into divulging credentials and multi-factor authentication (MFA) tokens through fraudulent login portals.
Levi Strauss says hackers breached employee computers, accessed corporate data
Levi Strauss & Co. has confirmed that an unauthorized third party accessed and exfiltrated corporate data after compromising employee computers through a social engineering attack. The iconic apparel manufacturer disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC) on Friday, August 7th, 2026.
AI-generated phishing texts bypass human intuition
A recent pilot study conducted at Brigham Young University indicates that individuals struggle to distinguish between phishing text messages generated by AI and those crafted by humans, particularly when the messages are personalized with work-related details. The study involved 25 volunteers who were presented with a mix of AI-generated and human-written text messages, tailored to their…
ESET tracks rise in malicious AI skills and adaptable malware
ESET's H1 2026 Threat Report indicates a significant increase in the use of artificial intelligence by attackers, both in developing malicious AI components and integrating AI into malware itself. The cybersecurity firm analyzed nearly 900,000 AI "skills"—functional components for AI agents—during the first half of 2026, identifying tens of thousands as suspicious and thousands as overtly…
3 Ways AI Powers Service Desk Attacks and How to Prevent Them
Artificial intelligence is becoming a significant tool for attackers targeting service desks, as highlighted by IBM's 2025 Cost of a Data Breach Report, which found AI used in 16% of breaches. These attacks often leverage AI for sophisticated phishing and deepfake impersonation, aiming to bypass technical security controls by manipulating service desk agents. The onboarding process is…
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts
A sophisticated phishing campaign is actively targeting marketing professionals with deceptive job offers, aiming to compromise their Google account credentials. The attackers are impersonating well-known brands to lend credibility to their fraudulent recruitment efforts.
How the Reddit and Discord false report scam steals accounts
A social engineering scam is targeting users on Reddit and Discord, aiming to steal account credentials and lock users out of their accounts. The scam typically begins with a direct message from a stranger claiming that their account has been reported, and that the reporting account appears to be yours. Alternatively, the scammer might claim they accidentally reported your account and need…